CVE-2023-6824

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Unknown	WP Customer Area	< 8.2.1

References

https://wpscan.com/vulnerability/a224b984-770a-4534-b689-0701b582b388/Third Party Advisory
https://wpscan.com/vulnerability/a224b984-770a-4534-b689-0701b582b388/Third Party Advisory

Timeline

Published: Jan 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-68259.9The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7 CVE-2023-68267.2The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' funct CVE-2023-68278.8The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajax CVE-2023-68286.1The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site S CVE-2023-68306.1The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows u CVE-2023-68318.1Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.CVE-2023-68324.3Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-68334.4Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator allows local users to gain sensitive info CVE-2023-68355.3Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could CVE-2023-68367.5Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely us CVE-2023-68378.2Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerabil CVE-2023-68386.1Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both auth